User behavior recognition method, electronic device, and computer-readable storage medium

Abstract

This application discloses a user behavior recognition method, electronic device, and computer-readable storage medium, relating to the field of artificial intelligence technology. The method includes: performing feature modeling based on first behavior data and interaction log data of the user under test within a first time period to determine a first behavior feature; performing feature modeling based on second behavior data of the user under test within a second time period to determine a second behavior feature of the user under test; fusing the first and second behavior features to obtain a third behavior feature; determining a fourth behavior feature based on the deviation between the user under test's multi-dimensional operation data and preset reference operation data, as well as the behavioral entropy of the multi-dimensional operation data; and inputting the third and fourth behavior features into a risk recognition model to predict the risk recognition result corresponding to the user under test. This application improves the accuracy of risk recognition for user behavior.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to user behavior recognition methods, electronic devices, and computer-readable storage media. Background Technology

[0002] With the widespread adoption of internet finance and mobile payments, user transaction and operational behavior data is growing exponentially. Financial risk control systems need to identify potential fraud risks in user behavior in real time from massive, multi-source, and heterogeneous data. Existing solutions typically process behavioral data representing long-term attack and defense situations separately from those representing short-term situations. This approach has the following drawbacks: First, extracting fixed patterns from historical attack and defense logs based on rule engines or shallow machine learning models makes it difficult to capture the stable attack preferences that fraudsters gradually evolve in long-term confrontations. Second, anomaly detection for current operations relies heavily on single-modal statistical features, failing to integrate cross-modal behavioral patterns and the dynamic changes in the global risk control environment. Ultimately, this results in traditional risk behavior identification strategies lacking sufficient accuracy and real-time performance in detecting complex fraud methods, and exhibiting poor accuracy in classifying the behavior of risky users. Summary of the Invention

[0003] The main objective of this application is to provide a user behavior recognition method, electronic device, and computer-readable storage medium, which aim to improve the accuracy of risk recognition of user behavior.

[0004] To achieve the above objectives, this application proposes a user behavior recognition method, which includes: Feature modeling is performed based on the first behavior data and interaction log data of the user under test within the first time period to determine the first behavior features; Feature modeling is performed based on the second behavioral data of the user under test during the second time period to determine the second behavioral features of the user under test. By combining the first behavioral feature and the second behavioral feature, a third behavioral feature is obtained; The fourth behavioral feature is determined based on the deviation between the multi-dimensional operation data of the user under test and the preset reference operation data, as well as the behavioral entropy of the multi-dimensional operation data. The third and fourth behavioral features are input into the risk identification model to predict the risk identification result corresponding to the user to be tested.

[0005] In one embodiment, the step of fusing the first behavioral feature and the second behavioral feature to obtain the third behavioral feature includes: Obtain risk control parameters, and concatenate the first behavioral feature, the second behavioral feature, and the risk control parameters to obtain a first concatenated feature vector; Based on the first concatenated feature vector, construct the risk signal features corresponding to the user under test; Based on the preset attack strategy distribution function and defense strategy distribution function, the risk signal features are processed to determine the mutual information metric value. The mutual information metric value is used to characterize the similarity of the strategy distribution and strategy change direction of the attacking and defending parties in the transaction behavior risk identification scenario. The risk signal features and the mutual information metric are input into a fully connected network, and the third behavioral feature is output through the fully connected network.

[0006] In one embodiment, the step of constructing the risk signal features corresponding to the user under test based on the first concatenated feature vector includes: Transform the first concatenated feature vector to the complex frequency domain to obtain complex frequency domain features; The complex frequency domain features are subjected to frequency band filtering to generate a first frequency band feature, a second frequency band feature, and a third frequency band feature, wherein the first frequency band feature, the second frequency band feature, and the third frequency band feature are located in different frequency bands; Inverse transformations are performed on the first frequency band feature, the second frequency band feature, and the third frequency band feature respectively to generate corresponding time-domain frequency band features; By aggregating the time-domain frequency-band features described above, the risk signal features are obtained.

[0007] In one embodiment, the step of processing the risk signal features based on a preset attack strategy distribution function and a defense strategy distribution function to determine the mutual information metric includes: The risk signal features are input into the attack strategy distribution function to obtain the risk attack strategy distribution features; The risk signal features are input into the defense strategy distribution function to obtain the defense strategy distribution features; Calculate the mutual information metric between the risk attack strategy distribution characteristics and the defense strategy distribution characteristics.

[0008] In one embodiment, the fully connected network includes at least a plurality of fully connected subnetworks and an activation function; The step of inputting the risk signal features and the mutual information metric into a fully connected network, and outputting a third behavioral feature through the fully connected network, includes: The risk signal features and the mutual information metric are concatenated to obtain the second concatenated vector features; The second spliced ​​vector feature and the risk signal feature are residually fused to obtain the fused risk feature; The fused risk features are extracted by each of the fully connected sub-networks to obtain risk signal features of different fine granularities, wherein each of the fully connected sub-networks corresponds to a different fine granularity. The risk signal features of different fine granularities are weighted and fused to obtain the third behavioral feature.

[0009] In one embodiment, the step of determining the fourth behavioral feature based on the deviation between the multi-dimensional operation data of the user under test and preset reference operation data, and the behavioral entropy of the multi-dimensional operation data, includes: Based on the numerical characteristics of each dimension in the multi-dimensional operational data, calculate the behavioral entropy corresponding to each dimension. Based on the numerical characteristics of each dimension in the multi-dimensional operation data and the reference operation data, the deviation degree corresponding to each dimension is calculated. The entropy of each behavior and the deviation of each behavior are weighted and fused to obtain the fifth behavior feature; The third and fifth behavioral features are input into a multi-head attention network to obtain the sixth behavioral feature; The sixth row feature is pooled to obtain the seventh row feature; The seventh row feature is input into the fully connected layer to obtain the fourth row feature.

[0010] In one embodiment, the step of calculating the behavioral entropy corresponding to each dimension based on the numerical characteristics of each dimension in the multi-dimensional operational data includes: The multi-dimensional operational data is denoised and normalized to obtain a numerical feature sequence. The numerical features of each dimension in the numerical feature sequence are divided into corresponding numerical intervals to obtain a discrete feature sequence, wherein each numerical interval corresponds to a behavior pattern category. Calculate the ratio of the frequency of each behavior pattern category in the discrete feature sequence to the sampling frequency of the multi-dimensional operation data to obtain the category ratio corresponding to each behavior pattern category; The behavioral entropy of the user under test in each dimension is calculated based on the category ratio corresponding to each behavioral pattern category in each dimension.

[0011] In one embodiment, the step of calculating the behavioral entropy corresponding to each dimension based on the numerical characteristics of each dimension in the multi-dimensional operational data includes: The multi-dimensional operational data is denoised and normalized to obtain a numerical feature sequence. The numerical features of each dimension in the numerical feature sequence are divided into corresponding numerical intervals to obtain a discrete feature sequence, wherein each numerical interval corresponds to a behavior pattern category. Calculate the ratio of the frequency of each behavior pattern category in the discrete feature sequence to the sampling frequency of the multi-dimensional operation data to obtain the category ratio corresponding to each behavior pattern category; The behavioral entropy of the user under test in each dimension is calculated based on the category ratio corresponding to each behavioral pattern category in each dimension.

[0012] In addition, to achieve the above objectives, this application also proposes an electronic device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the user behavior recognition method as described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the user behavior recognition method described above.

[0014] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the user behavior recognition method described above.

[0015] The user behavior recognition method provided in this application firstly performs feature modeling based on the first behavior data and interaction log data of the user under test within a first time period to determine the first behavior feature. This first behavior feature is determined by the user's historical first behavior data and interaction log data within the first time period, thus reflecting long-term stable attack preferences. Then, based on the second behavior data of the user under test within a second time period, feature modeling is performed to determine the second behavior feature. This second behavior feature is determined based on the second behavior data within the second time period, thus reflecting the user's immediate reaction at the current time. Finally, the first and second behavior features are fused to obtain the third behavior feature. This fused third behavior feature reflects the relevant characteristics of the user's long-term and short-term offensive and defensive postures, providing a more comprehensive approach compared to traditional risk identification strategies, and enabling collaborative perception of global situation and local anomalies. Based on the multiple... The deviation between the multi-dimensional operational data and the preset reference operational data, as well as the behavioral entropy of the multi-dimensional operational data, are used to determine the fourth behavioral feature. This fourth behavioral feature, determined based on the multi-dimensional operational data, provides a more in-depth and detailed characterization of the fine-grained correlation between multi-dimensional operational data and user behavior compared to risk identification using only transaction features or single sensor signals. This improves the ability to identify high-intensity persistent attacks. The third and fourth behavioral features are input into the risk identification model to predict the risk identification result corresponding to the user under test. The technical solution of this application, by introducing dual indicators of behavioral entropy and deviation in the behavioral feature extraction stage and combining them with the aforementioned behavioral features representing long-term and short-term attack trends, can effectively overcome the deficiencies in detection accuracy and real-time performance for complex fraud methods, as well as the poor accuracy in classifying the behavioral categories of risky users. This improves the comprehensiveness, real-time performance, and accuracy of behavioral risk identification. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the user behavior recognition method in the embodiments of this application; Figure 2 This is a flowchart illustrating the process of determining the third behavioral feature in an embodiment of this application; Figure 3This is a flowchart illustrating the process of determining the fourth behavioral feature in an embodiment of this application; Figure 4 This is a schematic diagram of the data flow of a feasible user behavior recognition process in an embodiment of this application; Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the user behavior recognition method in this application embodiment.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0021] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0022] For ease of understanding, the following explains some key terms in the various embodiments of this application: Interaction log data: Log data used to reflect the attack and defense processes generated by the system during user transaction behavior.

[0023] Multi-dimensional operational data: This includes operational data generated by users in transaction behavior from multiple dimensions (such as data from actions like entering passwords and confirming transactions). It can include data from various dimensions, such as pressure sensor data, accelerometer data, rotational speed data, and environmental noise intensity.

[0024] Behavioral entropy: In this embodiment of the application, it refers to imperceptible behavioral entropy, which extends the concept of "entropy" (a measure of disorder or uncertainty) in thermodynamics and information theory to the field of human or animal behavior, in order to quantify the unpredictability, randomness or dispersion of behavioral sequences.

[0025] Long Short-Term Memory (LSTM): A type of recurrent neural network designed specifically to address the long-term dependency problem inherent in general RNNs (Recurrent Neural Networks). All RNNs have a chain-like structure of repeating neural network modules.

[0026] Gated recurrent units (GRUs) are an important variant of recurrent neural networks, specifically designed to solve the "long sequence dependency" problem of traditional RNNs. They simplify the structure of LSTM while retaining the ability to process time-series data, and are widely used in natural language processing, time series prediction, and other fields.

[0027] Recurrent Neural Networks (RNNs) are fundamental models for processing sequential data, particularly suitable for time-dependent tasks. Their core mechanism involves passing information between different time steps through hidden states, thereby capturing the dynamic evolution of the sequence. This structure can preserve historical information to some extent, enabling the understanding of long-term dependencies in user behavior or dialogue, such as gradual changes in interest, the emergence of latent needs, and the continuity of intent. Typical improved models developed based on this include Long Short-Term Memory (LSTM) networks and Gated Recurrent Units (GRUs), which enhance the retention of long-term information through gating mechanisms.

[0028] Self-attention is a widely used feature association method in sequence modeling. It treats each position in the input sequence simultaneously as a query, key, and value, calculating the association weights between positions based on similarity, thus directly capturing dependencies across arbitrary distances within the sequence. Because it does not rely on recursive structures, self-attention can process long sequences in parallel.

[0029] Multi-Head Attention (MGA) networks utilize multiple attention heads set up in parallel. Each head computes the relevance weights between the query, key, and value in an independent subspace, thereby uncovering dependency patterns in sequences from different perspectives. The outputs of all attention heads are then concatenated and integrated through a linear transformation to form a comprehensive feature representation. This design allows the model to focus on multiple semantic cues simultaneously, significantly enhancing its ability to model complex structures and long-distance associations.

[0030] Multilayer Perceptron (MLP): MLP models can capture complex interactions between risk features through multilayer nonlinear transformations, thereby improving the accuracy of fraud detection.

[0031] Currently, in scenarios targeting user behavioral risk identification (such as in the financial sector), feature modeling of user behavioral data is required. In long-term situational modeling, traditional methods often employ single recurrent neural networks (RNN / LSTM) to encode transaction and attack / defense log sequences, but lack differentiated attention to the weights of historical events. This causes the model to easily overlook key attack / defense nodes when dealing with long sequences, affecting the perception of persistent risks. In short-term anomaly detection, existing designs are mostly based on manually set behavioral rules or simple time-series models, utilizing only transaction features or single sensor signals. This makes it difficult to characterize the fine-grained correlations between multi-dimensional operations (such as pressure, acceleration, angular velocity, and environmental noise), limiting the ability to identify advanced persistent attacks.

[0032] In addition, existing solutions often operate situation modeling and behavior detection as independent modules, lacking deep integration at the feature level. This results in the inability to fully utilize the complementarity of short-term and long-term information when making risk decisions. It may miss slow-accumulating risks across sessions or fail to respond adequately to instantaneous anomalies, making it difficult to meet the requirements of high concurrency and low latency financial-grade real-time risk control.

[0033] To overcome the shortcomings of the prior art, this application provides a user behavior recognition method, which is applied to a user behavior recognition device. In this application embodiment, reference is made to… Figure 1 , Figure 1 This is a flowchart illustrating the user behavior recognition method of this application. In this embodiment, the user behavior recognition method includes: Step S10: Perform feature modeling based on the first behavior data and interaction log data of the user under test within the first time period to determine the first behavior features; The users to be tested are those requiring behavioral risk identification, such as those in the financial sector with loan needs. The primary behavioral characteristic of the users to be tested is their historical behavioral characteristics, representing their transaction behavior over a past period. This includes data from various dimensions of the user's transaction activities, such as transaction amount, frequency, and time. Interaction log data can include information related to security attacks and defenses, such as the device used during the transaction, transaction location, and network environment. After feature modeling these data, primary behavioral characteristics that can be recognized by neural networks or deep learning models can be obtained. These primary behavioral characteristics can be understood as the user's transaction behavior over a relatively long period, enabling subsequent risk identification processing to focus on the user's long-term transaction characteristics and improve the comprehensiveness of behavioral identification.

[0034] "Feature modeling" refers to the process of extracting, constructing, and transforming structured numerical features from primary behavioral data and interaction log data into features that can be understood by machine learning models. Specifically, feature modeling includes two aspects: first, feature extraction and representation, which vectorizes user behavioral data and log data to transform them into meaningful quantitative indicators. For example, extracting frequency, amount fluctuations, and intervals from transaction sequences. Second, feature fusion to construct the interaction structure between features, enabling the model to capture multi-dimensional, fine-grained relationships, such as the temporal correspondence between behavioral data and interaction log data, and correspondences in causality, attribution, and other logical aspects. The resulting primary behavioral features are characterized by a time series structure.

[0035] Step S20: Perform feature modeling based on the second behavior data of the user under test within the second time period to determine the second behavior features of the user under test; The second time period is a time window close to the user-defined time, such as today, the most recent hour, or the most recent 30 minutes. This second time period can be set according to actual needs and is not limited here. The second behavioral data refers to transaction data within the second time period. The resulting second behavioral characteristics can be understood as the user's transaction behavior characteristics within a relatively short time interval, enabling subsequent risk identification to focus on the user's short-term transaction characteristics and improving the timeliness of behavior identification.

[0036] Among them, "feature modeling" refers to the process of extracting, constructing and transforming structured numerical features from the second-row data into features that can be understood by machine learning models. Specifically, it includes feature extraction and representation, and sorting them out according to the timeline to obtain the corresponding second-row features.

[0037] It should be noted that there is no fixed order of execution between steps S10 and S20. Step S10 can be executed first and then step S20, or step S20 can be executed first and then step S10, or they can be executed simultaneously. No restrictions are imposed here.

[0038] Step S30: Merge the first behavioral feature and the second behavioral feature to obtain the third behavioral feature; After obtaining the first behavioral feature representing transaction behavior over a long period of time and the second behavioral feature representing transaction behavior within a shorter time interval, the first behavioral feature and the second behavioral feature are fused together to obtain the third behavioral feature, which can completely represent the user's transaction behavior characteristics.

[0039] Step S40: Determine the fourth behavioral feature based on the deviation between the multi-dimensional operation data of the user under test and the preset reference operation data, as well as the behavioral entropy of the multi-dimensional operation data. To improve the accuracy of identifying user behavior risks, compared with traditional risk identification strategies, this application embodiment uses multi-dimensional operational data to characterize the transaction behavior features of the user under test. For example, for the user's current key financial operations (such as entering a password or confirming a transaction), specifically, feature data of various dimensions generated by the user during the transaction operation can be collected based on a preset sampling frequency to obtain the multi-dimensional operational data.

[0040] Specifically, the behavioral entropy of the multi-dimensional operation data of the user under test is used to measure the stability of the user's transaction behavior. When the behavioral entropy is high, it indicates that the multi-dimensional operation data of the user at different time steps are significantly different, the possibility of anomalies is higher, and the corresponding fraud risk is also higher.

[0041] On the other hand, this application embodiment also combines the deviation between multi-dimensional operational data and preset reference operational data to identify the risks in user transaction behavior. The reference operational data represents the performance of normal users in multi-dimensional operational data during transaction behavior. The greater the deviation between the multi-dimensional operational data of the user under test and the reference operational data, the higher the degree of abnormality and the greater the corresponding behavioral risk. Conversely, the smaller the deviation between the multi-dimensional operational data of the user under test and the reference operational data, the more the user under test conforms to the operating habits of normal users, and the lower the corresponding behavioral risk. Finally, the aforementioned deviation and behavioral entropy are fused and processed to obtain a fourth behavioral feature, which comprehensively represents the risk level corresponding to the deviation and behavioral entropy.

[0042] Step S50: Input the third and fourth behavioral features into the risk identification model to predict the risk identification result for the user to be tested.

[0043] Finally, after obtaining the third behavioral feature representing the risk of user transaction behavior and the fourth behavioral feature representing the risk level of user multi-dimensional operation data, they are input together into a pre-trained risk identification model. The risk identification model can be a multilayer perceptron (MLP). The risk identification model performs multilayer nonlinear transformations on the third and fourth behavioral features to capture the interaction relationship between features, and finally outputs a risk identification result representing the behavioral risk status of the user under test. This risk identification result can be a risk score, a user behavior identification category (such as no risk, low risk, medium risk, high risk, etc.), or a probability distribution corresponding to multiple user behavior identification categories, etc., without any restrictions.

[0044] In the actual implementation, the risk identification result generation process actually uses a lot of variable parameters (also known as learnable parameters). In order to ensure the accuracy of the final risk identification result, the risk identification model can be trained and learned using samples before it is put into actual use. At this time, the third and fourth behavioral features can be constructed based on the data in the training samples.

[0045] The training process of the risk identification model may include: comparing the risk identification result with the real risk result to generate an identification loss value, wherein the real risk result is a pre-set correct identification result; the identification loss value is constructed based on weighted cross-entropy, or based on weighted cross-entropy and contrastive bias constraint, wherein the contrastive bias constraint is used to force positive samples and negative samples to produce differences in the feature space; The recognition learning parameters are updated based on the recognition loss value. These recognition learning parameters are variable parameters used in risk recognition.

[0046] It should be noted that the standard recognition result can be a pre-set correct recognition result, such as a pre-set correct recognition result for the training samples. The recognition learning parameters can include variable parameters used in risk recognition, such as variable parameters used in constructing behavioral anomaly information and behavioral risk features, as well as parameters in the recognition model. More or fewer parameters can be included depending on actual needs, and this is not limited.

[0047] In practical applications, the difference between the risk identification result and the standard identification result can be calculated using the cross-entropy loss function, thereby generating the identification loss value. The expression can be: ; In the formula, L dlg To identify the loss value; T' can be the length of the identification output sequence corresponding to the risk identification result; y t It can be the probability corresponding to the t-th category in the standard recognition results; Let t be the probability that the predicted class t by the identification model matches the actual class t in the identification results.

[0048] In practical applications, to overcome the limitation of traditional cross-entropy loss treating all samples equally, the concept of hard example mining is introduced. This involves combining weighted cross-entropy with contrastive bias constraints to calculate the recognition loss value, resulting in the following expression: ; In the formula, L dlg To identify the loss value; y t It can be the probability corresponding to the t-th category in the standard recognition results; S represents the probability that the predicted class t by the identification model matches the actual class t in the identification results. pos S neg represents the output scores of the recognition model for positive (fraudulent) and negative (normal) samples, respectively; is the marginal hyperparameter used to enforce the separability of positive and negative samples in the recognition space; is the trade-off coefficient for the comparison constraint, m and . All of these can be pre-configured by the administrators of the risk detection equipment. Among them, the contrast bias constraint is used to force fraudulent samples to be separated from normal samples in the feature space, where wt = 1 + γ G score G score This is for risk scoring corresponding to the third behavioral characteristic.

[0049] Furthermore, in a feasible embodiment, step S10, which involves performing feature modeling based on the first behavior data and interaction log data of the user under test within a first time period to determine the first behavior features, may include: Step S11: Vectorize the first row of data and the interaction log data to obtain the corresponding first row vector and interaction log vector; Step S12: Fuse the first row vector and the interaction log vector to obtain the fused feature vector; Step S13: Input the fused feature vector into the long short-term memory network to determine the first behavioral feature of the user to be tested.

[0050] First, it is necessary to perform feature vectorization processing on the user's past first-behavior data (i.e., transaction behavior data) and the system's attack and defense interaction records (i.e., interaction log records). The core objective of feature vectorization processing is to transform heterogeneous, unstructured raw data into fixed-length, numerical time-series feature vectors (including first-behavior vectors). and interaction log vector Based on the actual situation and type of the data, the following methods can be adopted, such as normalization, category feature encoding, time window aggregation, behavior sequence discretization and embedding, etc.

[0051] Then, the characteristics of transaction behavior Features of corresponding attack and defense interaction logs By concatenating or fusing the components, a fused feature vector is obtained. Furthermore, based on the fused feature vector The embedded representation and the pre-trained Long Short-Term Memory (LSTM) network encoder generate the first behavioral features of the user under test. As an implicit representation of long-term offensive and defensive posture.

[0052] Furthermore, in one feasible embodiment, the long short-term memory network includes an encoder and an attention network; Step S13, which involves inputting the fused feature vector into a long short-term memory network to determine the first behavioral feature of the user under test, may include: Step S131: Generate a first hidden state vector for each time step in the fused feature vector using the encoder, and determine the first hidden state vector of the last time step as the first query vector; Step S132: Input the first query vector and each first hidden state vector into the attention network, and perform attention-weighted summation on each first hidden state vector based on the first query vector to obtain the first behavioral feature.

[0053] In this embodiment, a pre-trained LSTM encoder can be used to encode the fused feature vector step by step, generating a hidden state vector for each time step of the fused feature vector. and the query vector of the last time step Then query vector The key is input into the attention network, and attention-weighted summation is performed on each hidden state of the historical sequence to obtain the first behavioral feature. .

[0054] The reason for using the hidden state vector of the last time step as the query vector is that the last time step usually contains complete sequence information. This is determined by the fact that the last hidden state of the LSTM contains the context information of the entire sequence. The query vector can serve as a global representation to represent the semantics or features of the entire sequence and can be used as a KEY to measure the correlation and weight between the sequence and each historical time step.

[0055] Among them, query vector It plays a crucial guiding role in the weight allocation during attention weighting. In the process of calculating attention weights, the query vector, as the KEY, is used to calculate similarity with each hidden state vector of the historical sequence. For example, by calculating the query vector... With each hidden state vector The similarity (such as dot product, cosine similarity, etc.) is used to determine the importance weight of each time step. These weights determine the contribution of historical information to the final output. It is understandable that the query vector... This represents the final state or overall information of the sequence formed at each time step, through... As the key, the attention mechanism can identify which historical time steps are most relevant to the current state, achieving automatic focus on important historical information and suppression of irrelevant information. This design enables the model to make more intelligent use of historical information and improve its ability to recognize complex time series patterns.

[0056] In one feasible embodiment, step S20, which involves performing feature modeling based on the second behavioral data of the user under test within a second time period to determine the second behavioral features of the user under test, may include: Step S21: Input the second row feature into the gated recurrent network, and perform time series modeling on the second row data through the gated recurrent network to obtain the second hidden state vector at each time step and the second query vector at the last time step. Step S22: Input the second query vector and each second hidden state vector into the attention network, and perform attention-weighted summation on each second hidden state vector based on the second query vector to obtain the second behavioral feature.

[0057] On the other hand, for the modeling needs of short-term offensive and defensive situations, attention mechanisms can be used to obtain the corresponding implicit short-term offensive and defensive situation representation. For example, the feature sequence of the user under test within the current trading window is collected as the second behavioral feature, and then the second behavioral feature is input into a gated recurrent network (GRU). The GRU performs temporal modeling on the second behavioral feature step by step through the gated recurrent network to obtain multiple corresponding second hidden state vectors. and query vector Finally, the input is fed into an attention network for attention-weighted summation to obtain the second behavioral feature.

[0058] Specifically, a GRU network is used to encode the embedding at each time step of the user's current transaction to obtain the second hidden state vector. and query vector The steps may include: after inputting the second behavioral feature into the GRU network, updating the corresponding second hidden state vector for each time step t, and using the hidden state vector of the last time step as the query vector. The embodiments of this application employ a GRU encoding strategy, which can capture time dependencies, remember the impact of past actions on the current state, and alleviate the problem of long-term dependencies: compared to LSTM, it has fewer parameters, is slightly faster to train, and can remember longer-term patterns (gating mechanism).

[0059] The process of performing attention-weighted summation on the second hidden state vector at each time step based on the query vector is similar to the attention-weighted summation process in step S132 above, and will not be repeated here.

[0060] In one feasible embodiment, such as Figure 2 As shown, step S30, which involves fusing the first behavioral feature and the second behavioral feature to obtain the third behavioral feature, may include: Step S31: Obtain risk control parameters, and concatenate the first row feature, the second row feature, and the risk control parameters to obtain the first concatenated feature vector; Step S32: Construct the risk signal features corresponding to the user to be tested based on the first concatenated feature vector; It is understandable that the first and second behavioral features are both user transaction behavior features corresponding to the user being tested. These are both dynamic features at the individual user level and lack a global perspective. Therefore, this embodiment introduces risk control parameters (which can be understood as a global risk control environment variable g) into feature fusion, giving the final third behavioral feature a global perspective. For example, the same user behavior (such as a large transfer) can have completely different risk implications under different global environments. For instance, when the entire platform is functioning normally, this user behavior might be a genuine transaction, while during a peak attack period on the entire platform, it is more likely to be fraud. In this case, the risk control parameter g is used to help the fully connected layer dynamically adjust the decision threshold. Furthermore, when a user's individual behavior is normal but originates from a high-risk region / high-risk IP segment, the risk control parameter can transmit group risk signals. The risk control parameters can be pre-set by the administrators of the risk detection equipment.

[0061] For example, the risk control parameter g is typically a fixed-length dense vector encoded by multiple macro-statistical indicators or global context features. These indicators may include one or more of the following: total number of attacks across the entire platform in the last 5 minutes, current risk index, average response latency across the entire platform, total number of online users, risk control system interception rate, whether it is a weekday / holiday, geographical hot zone risk level (indicating whether it is in a high-incidence attack area), indicators of recent new attack methods, and whether it is a promotional period. It should be noted that the risk control parameter g should be strictly aligned with the time of the current transaction (using the same timestamp) and environmental variables from previous and subsequent times should not be mixed.

[0062] Specifically, the first behavioral characteristic Second behavioral characteristics The calculation expression for concatenating the risk control parameter g can be shown below:

[0063] in, This is the first concatenated feature vector, and Concat represents the concatenation operation.

[0064] Once obtained, the risk signal features corresponding to the user under test can be constructed based on the first concatenated feature vector. The risk signal features are used to represent the continuous spatial feature representation corresponding to the user's transaction behavior.

[0065] In a specific implementation, to ensure the reasonable construction of risk signal features, step S32 may include: Step S321: Transform the first concatenated feature vector to the complex frequency domain to obtain complex frequency domain features; Step S322: Perform frequency band filtering on the complex frequency domain features to generate first frequency band features, second frequency band features and third frequency band features, wherein the first frequency band features, second frequency band features and third frequency band features are located in different frequency bands; Step S323: Perform inverse transformations on the first frequency band features, the second frequency band features, and the third frequency band features respectively to generate corresponding time-domain frequency band features; Step S324: Aggregate the frequency band features of each time domain to obtain the risk signal features.

[0066] Specifically, the first concatenated feature vector is first subjected to a Labras transform to map it to the complex frequency domain, thereby obtaining the complex frequency domain features. Then, a learnable frequency domain response function is set to perform frequency band filtering on the complex frequency domain features, thereby generating first frequency band features, second frequency band features, and third frequency band features corresponding to different frequency bands. After that, the first frequency band features, second frequency band features, and third frequency band features are respectively subjected to inverse transforms to obtain the time-domain frequency band features. Finally, the time-domain frequency band features corresponding to each frequency band feature are assembled to obtain the risk signal features.

[0067] To make it easier to understand, the following examples are provided: Applying a Laplace transform to the first concatenated feature vector and mapping it to the complex frequency domain yields the complex frequency domain feature C0(s), which can be characterized as: ; Then, based on the learnable parameter θ, a learnable frequency domain response function H is constructed, and band-division filtering is performed, resulting in: For the long-term trend component (first frequency band characteristics): ; For short-term intermediate frequency components (second frequency band characteristics): ; For high-frequency components of the environment (third frequency band characteristics): ; Then, by performing inverse Laplace transforms on the features of each frequency band, the time-domain frequency band features can be obtained: ; Among them, the time-domain frequency band characteristics can be divided into the first time-domain frequency band characteristics according to the different corresponding frequency band characteristics. Second time-domain frequency band characteristics and the third time domain frequency band characteristics

[0068] Finally, the time-domain frequency band features are assembled into the risk signal feature F(t), and the corresponding expression is: ; It should be noted that by separating the spliced ​​feature vector into low-frequency trends, mid-frequency behaviors, and high-frequency environmental mutations, the physical decoupling of risk information at different time scales is achieved. This ensures that each frequency band component is strictly aligned with the risk control semantics of "long-term preference - short-term anomaly - environmental shock," avoiding mutual interference between fast and slow signals in the feature space. At the same time, by using the learnable parameter θ to dynamically adjust the filter passband characteristics, the model effectively suppresses high-frequency jitter and low-frequency drift unrelated to behavioral risk identification while retaining key attack and defense patterns, significantly enhancing the model's noise resistance and stability in complex financial environments. Furthermore, the frequency band processing enables the subsequent residual fusion and multi-scale aggregation modules to reorganize features based on explicit frequency semantics, providing a frequency domain dimension attribution basis for determining high risk and overcoming the deficiency of traditional black-box models that lack physical interpretation.

[0069] Step S33: Based on the preset attack strategy distribution function and defense strategy distribution function, process the risk signal features and determine the mutual information metric value. The mutual information metric value is used to characterize the similarity of the strategy distribution and strategy change direction of the attacking and defending parties in the transaction behavior risk identification scenario. In practical applications, risk signal features can be processed through two learnable mapping functions to obtain the defensive and offensive strategy distributions. Then, based on these distributions, the mutual information metric is determined by combining the gradients of the risk signal features across each strategy dimension. In the process of fraudulent transactions, the attacker refers to the party committing the fraudulent act (e.g., maliciously attacking users), while the defender refers to the party identifying the fraudulent act (e.g., a platform providing financial products or services).

[0070] Furthermore, the aforementioned step S331 may include: By inputting the risk signal features into the attack strategy distribution function, the risk attack strategy distribution features are obtained through mapping. By inputting the risk signal characteristics into the defense strategy distribution function, the defense strategy distribution characteristics are obtained through mapping. Calculate the mutual information metric between the distribution characteristics of risk attack strategies and the distribution characteristics of defense strategies.

[0071] The risk signal characteristics can be expressed as follows: ; At this point, the attacking strategy distribution characteristics can be defined as follows: The attacker's strategy distribution characteristics can be learned from F(t) through the attack strategy distribution function, which is the mapping function M. AAfter mapping, it can be characterized as:

[0072] We can assume the defensive strategy distribution is as follows: The distribution characteristics of the defender's strategy can be learned from F(t) through the defense strategy distribution function, i.e., the mapping function M can be obtained. D After mapping, it can be characterized as: ; The mutual information metric between the distribution characteristics of risk attack strategies and the distribution characteristics of defense strategies is expressed as: ; In the formula, K represents the total number of strategy dimensions; Let the gradient of the risk signal feature be the i-th policy dimension. φ(t) represents the gradient of the risk signal feature on the j-th policy dimension; cos∠() is a function that calculates the cosine of the angle between the two gradients, used to reflect the similarity of the direction of change of the offensive and defensive policies in the risk signal feature; φ(t) is the mutual information metric.

[0073] When φ(t) is high, it indicates that the offensive and defensive strategies are changing in the same direction in the risk signal characteristics, and the system is in a high-risk confrontation state; when φ(t) is low, it indicates that the offensive and defensive strategies are changing in different directions, and the system is in a risk release state.

[0074] It should be noted that φ(t) transforms the abstract intensity of attack and defense confrontation into a continuous numerical indicator by quantifying the similarity of the strategy distribution and changing direction of both sides in the risk signal features. This allows for a more sensitive capture of the dynamic characteristics of both sides in slow-changing trends and instantaneous fluctuations, effectively distinguishing between high-risk confrontation states and risk release states. Furthermore, by explicitly introducing φ(t) into feature fusion and loss constraints, the model's ability to perceive the evolution of attack and defense can be enhanced, providing physical interpretability based on directional consistency for user behavior recognition.

[0075] Step S34: Input the risk signal features and mutual information metric into the fully connected network, and output the third behavior feature through the fully connected network.

[0076] Specifically, the mutual information metric and the time-domain frequency-division feature in the risk signal feature can be concatenated and then processed through multiple network layers in multiple fully connected networks to generate the third behavioral feature.

[0077] Furthermore, the fully connected network includes at least multiple fully connected subnetworks and activation functions, and step S34 may include: Step S341: Concatenate the risk signal features and mutual information metrics to obtain the second concatenated vector features; Step S342: Perform residual fusion of the second spliced ​​vector features and the risk signal features to obtain the fused risk features; Step S343: Extract features from the fused risk features through each fully connected sub-network to obtain various risk signal features with different fine granularities, wherein each fully connected sub-network corresponds to a different fine granularity; Step S344: Weighted fusion of risk signal features of different fine granularities is performed to obtain the third behavioral feature.

[0078] To make it easier to understand, the following examples are provided: First, Φ(t) is concatenated with the frequency band features in the risk signal characteristics to obtain the second concatenated vector. And by inputting the residual cross-domain fusion block, the fusion risk feature c2 is obtained, with the expression: ; Through the above fusion process, the risk signal features after frequency domain filtering can be combined with mutual information measurement to ensure that the subsequently generated feature representation contains both risk-related features and attack and defense strategy-related features.

[0079] Then, c2 can be passed through three parallel, fine-grained fully connected subnetworks FC. s1 FC s2 FC s3 The features are processed separately to capture features of three different granularities: fine, medium, and coarse. Then, they are weighted and fused. The expression is as follows: ; Finally, the weighted fusion result h is processed through an activation function and two additional fully connected networks FC1 and FC2 to obtain the third feature G, expressed as: ; Here, Concat represents the feature concatenation operation, FC1 and FC2 represent two different fully connected network layers, and ReLU is the activation function.

[0080] In another feasible embodiment, G can be further mapped to a risk score to more intuitively reflect the risk level represented by the user's trading behavior. The mapping expression can be: ; in For the Sigmoid function, For the weight vector, For biased scalars, Let G be the transpose of G.

[0081] In another feasible embodiment, steps S10, S20 and S30 can complete the task of generating the first behavioral feature, the second behavioral feature and the third behavioral feature through an overall model. During the training process of the model, the weighted mean square error loss function can be used to calculate the feature extraction bias, thereby measuring the accuracy of the model prediction and improving the model performance.

[0082] For example, the loss function of the model can be expressed as: ; in , , This represents the weighting parameter, used to adjust the importance of each loss. This represents the true label of the pre-collected third-behavioral features. The true label representing the first behavioral characteristic. The true label representing the second behavioral characteristic.

[0083] In practical applications, the first loss value can be defined as the feature reconstruction loss, which can be constructed using the Huber loss function combined with directional consistency constraints, and can be characterized as follows:

[0084] In the formula, L posture The first loss value is represented by Huber(); Huber() represents the Huber loss function. For directional consistency constraints; G is the third behavior feature; G λd represents the actual third-party behavioral features corresponding to the training samples used; λd is a preset coefficient that can be set in advance by the administrator of the risk detection equipment.

[0085] The second loss value can be the frequency domain consistency loss, used to constrain frequency distribution alignment, and introduces total variation (TV) regularization to smooth the filter response, which can be characterized as:

[0086] In the formula, L freq The second loss value; l, s, and g represent different frequency bands; Ci(s) represents the frequency band component of the i-th frequency band; C i(s) represents the frequency band component of the i-th frequency band in the real frequency band data corresponding to the training sample used; γ is a preset coefficient that can be set in advance by the administrator of the risk detection equipment.

[0087] The third loss value can be the attack / defense strategy function loss, used to introduce the idea of ​​contrastive learning, forcing high-risk and low-risk samples to be separated in the potential function space, forming a difference, which can be characterized as:

[0088] In the formula, L game Φ is the third loss value; Φ is the mutual information measure; Φ The actual mutual information metric corresponding to the training samples used; m and η are both preset coefficients that can be set in advance by the administrators of the risk detection equipment.

[0089] The fourth loss value can be an adversarial stability loss, which is a gradient penalty term based on the Wasserstein distance, used to improve training stability, and can be characterized as:

[0090] In the formula, L adv E[D(G)] is the fourth loss value; E[D(G)] is the average score for the generated third behavioral feature; E[D(G)] is the average score for the third behavioral feature. [)] represents the average score of the true third-party behavioral features corresponding to the training samples used. It is a randomly interpolated sample; It can be in The gradient value at that point.

[0091] In practical applications, the first, second, third, and fourth loss values ​​can be weighted and summed to obtain the total loss, resulting in:

[0092] In the formula, L total For the total loss, μ1-μ4 are preset weight values ​​that can be set in advance by the administrator of the risk detection equipment.

[0093] In practical applications, in each training iteration, after obtaining the third-order feature G, the frequency band components Ci(s), and the mutual information metric Φ(t) through forward propagation, L is calculated. total Then, backpropagation is used to update the learnable parameters (including LSTM / GRU parameters, fully connected layer parameters, learnable frequency domain response H(s;θ) parameters, and policy distribution mapping M). D M A The parameters are updated until convergence or the stopping condition is met. At this point, the system can be put into use. Subsequently, the third behavior feature can be calculated based on the updated parameters, and subsequent steps can be executed to generate risk identification results.

[0094] And the loss function L totalAs an optimization objective during the model training phase, learnable parameters generated during the third behavioral feature generation process are simultaneously updated via backpropagation. This not only ensures that the third behavioral feature G is numerically aligned with the ground truth, but also possesses interpretability of risk control semantics in its structure, significantly improving the model's training stability and generalization ability in complex adversarial environments.

[0095] In one feasible embodiment, such as Figure 3 As shown, step S40, which determines the fourth behavioral feature based on the deviation between the multi-dimensional operation data of the user under test and the preset reference operation data, as well as the behavioral entropy of the multi-dimensional operation data, may include: Step S41: Calculate the behavioral entropy corresponding to each dimension based on the numerical characteristics of each dimension in the multi-dimensional operation data. In this embodiment, behavioral entropy is used to measure the naturalness of user behavior. The multi-dimensional operation data includes numerical features of multiple dimensions corresponding to multiple time steps, such as pressure sensor readings, accelerometer data (used to represent the amplitude of device movement), rotation rate data, and environmental noise intensity. The greater the dispersion of the numerical features of each dimension at each time step, the greater the corresponding behavioral entropy and the greater the risk of the corresponding user behavior.

[0096] Specifically, step S41, which calculates the behavioral entropy corresponding to each dimension based on the numerical characteristics of each dimension in the multi-dimensional operational data, may include: Step S411: Denoise and normalize the multi-dimensional operational data to obtain a numerical feature sequence. Step S412: Divide the numerical features of each dimension in the numerical feature sequence into the corresponding numerical intervals to obtain a discrete feature sequence, wherein each numerical interval corresponds to a behavior pattern category. Step S413: Calculate the ratio of the frequency of each behavior pattern category in the discrete feature sequence to the sampling frequency of the multi-dimensional operation data, and obtain the category ratio corresponding to each behavior pattern category. Step S414: Calculate the behavioral entropy of the user under test in each dimension based on the category ratio corresponding to each behavioral pattern category in each dimension.

[0097] In calculating behavioral entropy, the first step is to manipulate the data from multiple dimensions. The data is processed according to a preset denoising and normalization method to obtain a standardized numerical feature sequence. .in This represents the pressure sensor reading at timestamp t. For accelerometer data (amplitude of device movement). Rotation rate data, Let T represent the ambient noise intensity and T be the total number of time steps in the current operation. Furthermore, to more intuitively measure the naturalness of user behavior, this embodiment divides the numerical features of each dimension in the numerical feature sequence into corresponding numerical intervals (K intervals, each interval corresponding to a behavior pattern category). This yields a discrete feature sequence, where each numerical interval corresponds to a behavior pattern category. For example, pressure sensor readings can be divided into three different numerical intervals [0, 0.3], [0.3, 0.7], and [0.7, 1.0], where the values ​​are normalized pressure sensor readings. The behavior model categories corresponding to the three intervals are light touch, normal press, and heavy press, respectively. For accelerometers, the readings can be divided into four different numerical intervals [0, 0.1], [0.1, 0.4], [0.4, 0.7], and [0.7, 1.0], respectively, corresponding to the behavior pattern categories of stationary device, slight shaking, obvious movement, and violent movement, respectively.

[0098] For each dimension, the frequency of each behavioral pattern category corresponding to the user at each time step in the discrete feature sequence is statistically analyzed, and the ratio of the frequency of each behavioral pattern category to the total sampling frequency is calculated. Taking the pressure sensor reading dimension as an example, the calculation expression is as follows: ; in, for The number of times the category appears for The category ratio corresponding to the category, where T is the total number of time steps (equivalent to the sampling frequency).

[0099] Further calculate the behavioral entropy (e.g., Unconscious Behavioral Entropy UBE) for the corresponding dimension based on the category ratio, and then use the results obtained from the above calculations. Substituting into the following expression, the behavioral entropy is calculated as follows: .

[0100] Step S42: Based on the numerical characteristics of each dimension in the multi-dimensional operation data and the reference operation data, calculate the deviation degree corresponding to each dimension. It should be noted that the deviation for each dimension represents the difference between the user's operational data and the reference operational data in each dimension. The reference operational data is multi-dimensional operational data generated by a large number of normal users in the course of their transactions throughout history. The greater the deviation, the higher the risk of the user's behavior.

[0101] Specifically, step S42, which calculates the deviation degree corresponding to each dimension based on the numerical characteristics of each dimension in the multi-dimensional operation data and the reference operation data, may include: Step S421: Obtain the mean and standard deviation of the numerical features of each dimension in the reference operation data; Step S422: For each time step, calculate the difference between the numerical feature of each dimension in the multi-dimensional operation data and the mean of the corresponding dimension in the reference operation data, and calculate the ratio of the difference to the standard deviation of the corresponding dimension in the reference operation data to obtain the deviation of the numerical feature of each dimension. Step S423: Combine the deviation of each dimension at each time step to calculate the deviation between the multi-dimensional operation data and the reference operation data.

[0102] The mean of the numerical characteristics of each dimension in the reference operation data and standard deviation Reflecting the average value and dispersion of historical user baselines, the numerical characteristics of each dimension in the multi-dimensional operational data at each time step t are represented as follows: The difference between this value and the mean reflects the difference between the numerical value and the reference data, which is then divided by the standard deviation.

[0103] The expression for calculating the deviation can be: .

[0104] Where m is the dimension index, and m ranges from 1 to M, and M is the total number of dimensions.

[0105] Step S43: Weighted fusion of the entropy of each behavior and the deviation of each behavior to obtain the fifth behavior feature; Before weighted fusion of behavioral entropy and deviation across dimensions, a normalization process is performed. The normalization expression for UBE and deviation for each dimension can be: ; in, For the normalized UBE, and These are the minimum and maximum UBE values ​​for each dimension, respectively. The deviation after normalization. and These represent the minimum and maximum deviation values ​​for each dimension, thus limiting the normalized UBE and deviation to between 0 and 1.

[0106] Weighted fusion can be calculated based on pre-set weights, as shown in the expression: ; in, The characteristics after fusion and These are the weights corresponding to UBE and deviation, respectively.

[0107] The fused features are then further subjected to a scoring mapping to obtain the fifth row of features. , The calculation expression is: ; in, , , All of these are pre-set parameters.

[0108] In another feasible embodiment, the calculation expression for the fifth row feature can also be: ; The Gaussian error function is... Learnable decision threshold offset It is a learnable scale parameter used to control the steepness of the transition zone.

[0109] Step S44: Input the third and fifth behavioral features into the multi-head attention network to obtain the sixth behavioral feature; Step S45: Perform pooling on the sixth row feature to obtain the seventh row feature; Step S46: Input the seventh row of features into the fully connected layer to obtain the fourth row of features.

[0110] In this step, a multi-head attention network is used to compare the third behavioral feature G with the fifth behavioral feature representing multi-dimensional operational data. The various features are weighted and assigned to obtain the sixth row of features. Then, a pooling layer is used to extract the feature information at a deeper level, resulting in the seventh row of features. The aforementioned calculation process can be summarized as follows: ; Where P represents the seventh behavioral feature. This is the sixth characteristic.

[0111] Finally, P is input into the fully connected layer FC, and the fourth row of output is the feature Y.

[0112] In another feasible embodiment, the model that determines the third behavioral feature and the model that subsequently determines the fourth behavioral feature can be jointly trained to jointly optimize the loss function, and the loss weights of the two tasks can be adjusted through two hyperparameters to minimize the total loss.

[0113] For example, the loss function expression can be: ; in, For the total loss, The prediction loss for the third behavioral feature. The prediction loss for the fourth behavior feature, and These are two hyperparameters used to adjust the weights of the losses for the two tasks, ensuring that the two loss terms are numerically comparable.

[0114] For ease of understanding, and in conjunction with the content of the foregoing embodiments, a feasible user behavior recognition process can be described as follows: Figure 4 As shown, the historical sequence (corresponding to long-term features) and the current transaction sequence (corresponding to short-term features) are processed by the LSTM encoder and the GRU encoder respectively, and then fused by the attention mechanism. The output features (i.e., the third feature) and the acquired user information (corresponding to the fourth behavioral feature) are jointly input into the MLP (i.e., risk identification model) for fraud identification, and finally the risk identification result is output.

[0115] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the user behavior recognition method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0116] This application also provides a user behavior recognition device. The user behavior recognition device provided in this application, employing the user behavior recognition method described in the above embodiments, can improve the accuracy of risk identification for user behavior. Compared with the prior art, the beneficial effects of the user behavior recognition device provided in this application are the same as those of the user behavior recognition method provided in the above embodiments, and other technical features in the user behavior recognition device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0117] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the user behavior recognition method in Embodiment 1 above.

[0118] The following is for reference. Figure 5 The diagram illustrates a structural schematic of an electronic device suitable for implementing embodiments of this application. The electronic device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones and laptops, and fixed terminals such as desktop computers. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0119] like Figure 5As shown, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. The communication device 1009 allows the electronic device to communicate wirelessly or wiredly with other devices to exchange data. Although the diagrams show electronic devices with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems may be implemented alternatively.

[0120] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0121] The electronic device provided in this application, employing the user behavior recognition method described in the above embodiments, can improve the accuracy of risk identification for user behavior. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the user behavior recognition method provided in the above embodiments, and other technical features of the electronic device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0122] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0123] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0124] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the user behavior recognition method in the above embodiments.

[0125] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0126] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0127] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by an electronic device, cause the electronic device to implement the user behavior recognition methods of the various embodiments described above.

[0128] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0129] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0130] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0131] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described user behavior recognition method, thereby improving the accuracy of risk identification of user behavior. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the user behavior recognition method provided in the above embodiments, and will not be repeated here.

[0132] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the user behavior recognition method described above.

[0133] The computer program product provided in this application can improve the accuracy of risk identification of user behavior. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the user behavior identification method provided in the above embodiments, and will not be repeated here.

[0134] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A user behavior recognition method, characterized in that, The user behavior recognition method includes: Feature modeling is performed based on the first behavior data and interaction log data of the user under test within the first time period to determine the first behavior features; Feature modeling is performed based on the second behavioral data of the user under test during the second time period to determine the second behavioral features of the user under test. By combining the first behavioral feature and the second behavioral feature, a third behavioral feature is obtained; The fourth behavioral feature is determined based on the deviation between the multi-dimensional operation data of the user under test and the preset reference operation data, as well as the behavioral entropy of the multi-dimensional operation data. The third and fourth behavioral features are input into the risk identification model to predict the risk identification result corresponding to the user to be tested.

2. The user behavior recognition method as described in claim 1, characterized in that, The step of fusing the first behavioral feature and the second behavioral feature to obtain the third behavioral feature includes: Obtain risk control parameters, and concatenate the first behavioral feature, the second behavioral feature, and the risk control parameters to obtain a first concatenated feature vector; Based on the first concatenated feature vector, construct the risk signal features corresponding to the user under test; Based on the preset attack strategy distribution function and defense strategy distribution function, the risk signal features are processed to determine the mutual information metric value. The mutual information metric value is used to characterize the similarity of the strategy distribution and strategy change direction of the attacking and defending parties in the transaction behavior risk identification scenario. The risk signal features and the mutual information metric are input into a fully connected network, and the third behavioral feature is output through the fully connected network.

3. The user behavior recognition method as described in claim 2, characterized in that, The step of constructing the risk signal features corresponding to the user under test based on the first concatenated feature vector includes: Transform the first concatenated feature vector to the complex frequency domain to obtain complex frequency domain features; The complex frequency domain features are subjected to frequency band filtering to generate first frequency band features, second frequency band features and third frequency band features, wherein the first frequency band features, the second frequency band features and the third frequency band features are located in different frequency bands; Inverse transformations are performed on the first frequency band feature, the second frequency band feature, and the third frequency band feature respectively to generate corresponding time-domain frequency band features; By aggregating the time-domain frequency-band features described above, the risk signal features are obtained.

4. The user behavior recognition method as described in claim 2, characterized in that, The step of processing the risk signal features based on preset attack strategy distribution functions and defense strategy distribution functions to determine the mutual information metric includes: The risk signal features are input into the attack strategy distribution function to obtain the risk attack strategy distribution features; The risk signal features are input into the defense strategy distribution function to obtain the defense strategy distribution features; Calculate the mutual information metric between the risk attack strategy distribution characteristics and the defense strategy distribution characteristics.

5. The user behavior recognition method as described in claim 2, characterized in that, The fully connected network includes at least multiple fully connected sub-networks and activation functions; The step of inputting the risk signal features and the mutual information metric into a fully connected network, and outputting a third behavioral feature through the fully connected network, includes: The risk signal features and the mutual information metric are concatenated to obtain the second concatenated vector features; The second spliced ​​vector feature and the risk signal feature are residually fused to obtain the fused risk feature; By extracting features from the fused risk features through each of the fully connected sub-networks, a variety of risk signal features with different fine-grained values ​​are obtained, wherein each of the fully connected sub-networks corresponds to a different fine-grained value; The risk signal features of different fine granularities are weighted and fused to obtain the third behavioral feature.

6. The user behavior recognition method as described in claim 1, characterized in that, The step of determining the fourth behavioral feature based on the deviation between the multi-dimensional operation data of the user under test and the preset reference operation data, and the behavioral entropy of the multi-dimensional operation data, includes: Based on the numerical characteristics of each dimension in the multi-dimensional operational data, calculate the behavioral entropy corresponding to each dimension. Based on the numerical characteristics of each dimension in the multi-dimensional operation data and the reference operation data, the deviation degree corresponding to each dimension is calculated. The fifth behavioral feature is obtained by weighted and fused together with the entropy of each behavior and the deviation of each behavior. The third and fifth behavioral features are input into a multi-head attention network to obtain the sixth behavioral feature; The sixth row feature is pooled to obtain the seventh row feature; The seventh row feature is input into the fully connected layer to obtain the fourth row feature.

7. The user behavior recognition method as described in claim 6, characterized in that, The step of calculating the behavioral entropy corresponding to each dimension based on the numerical characteristics of each dimension in the multi-dimensional operational data includes: The multi-dimensional operational data is denoised and normalized to obtain a numerical feature sequence. The numerical features of each dimension in the numerical feature sequence are divided into corresponding numerical intervals to obtain a discrete feature sequence, wherein each numerical interval corresponds to a behavior pattern category. Calculate the ratio of the frequency of each behavior pattern category in the discrete feature sequence to the sampling frequency of the multi-dimensional operation data to obtain the category ratio corresponding to each behavior pattern category; The behavioral entropy of the user under test in each dimension is calculated based on the category ratio corresponding to each behavioral pattern category in each dimension.

8. The user behavior recognition method as described in claim 6, characterized in that, The step of calculating the deviation corresponding to each dimension based on the numerical characteristics of each dimension in the multi-dimensional operation data and the reference operation data includes: Obtain the mean and standard deviation of the numerical features of each dimension in the reference operation data; For each time step, the difference between the numerical feature of each dimension in the multi-dimensional operation data and the mean of the corresponding dimension in the reference operation data is calculated, and the ratio of the difference to the standard deviation of the corresponding dimension in the reference operation data is calculated to obtain the deviation of the numerical feature of each dimension. By combining the deviation of each dimension at each time step, the deviation between the multi-dimensional operation data and the reference operation data is calculated.

9. An electronic device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the user behavior recognition method as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the user behavior recognition method as described in any one of claims 1 to 8.

Images